Under Art. 28 GDPR — September 2026 version
This DPA governs the personal-data processing INKOS (HIGH LABS FZE) performs on behalf of the Studio when the Studio uses the Platform to manage its own clients. It applies automatically upon acceptance of the Terms and is enforceable as an addendum to the service contract; it can be signed formally on Studio request.
Processing of the Studio's end-Client personal data within the scope of Platform features.
For the duration of the Studio's subscription, plus 30 days for export/erasure after termination.
Bookings, client records, messaging, projects, payments, invoicing, transactional emails/SMS, backups, mini-site and public widget generation. Purpose: provision of the INKOS service under the Studio's documented instructions.
Name, contact info, date of birth, graphic references, artist notes, session history, messages, payment data (via Stripe), free-text fields where the Studio may store health information (Art. 9 GDPR).
Current and prospective Studio clients, including anyone who fills the public intake form.
INKOS processes data only per the Studio's documented instructions — panel configuration (retention, consents, active fields), email requests to the Privacy Contact and this DPA. If an instruction is unlawful, INKOS will inform the Studio.
Confidentiality of authorised staff; appropriate technical and organisational measures; assistance to the Studio for data-subject requests and Arts. 32-36 GDPR compliance; prompt breach notification; audit rights per section 12.
Encryption in transit (TLS 1.2+); bcrypt cost 12+ for passwords; API-level isolation by studio_id; 2FA available; tamper-resistant audit log; encrypted backups; role-based access control.
The Studio authorises the current sub-processors listed at /subprocessors. INKOS notifies material changes at least 30 days in advance; the Studio may object in writing, in which case either party may terminate the affected service.
INKOS assists the Studio in responding to access, rectification, erasure, restriction, objection and portability requests, including panel-level export and delete features.
INKOS notifies the Studio without undue delay (target: 24 h from internal detection) with information sufficient to comply with Arts. 33/34 GDPR.
The Studio may request reasonable information to verify compliance once per year, with a minimum 30-day notice, under NDA. On-site audits only when strictly necessary and at the Studio's cost.
HIGH LABS FZE is UAE-based. Transfers rely on SCCs (Decision 2021/914) and applicable supplementary measures. See section 8 of the Privacy Policy.
Upon termination, the Studio may export all data for 30 days in CSV/JSON. After that period, INKOS deletes or anonymises the data unless legal retention applies.
A Studio may request formal e-signature by contacting privacy@highlabs.tech with legal name, address and VAT.